5 ms·

So if archive.is decided to also return garbage DNS results to Quad9 you would stop using them too? I get your sentiment, but allowing one single webpage on th

So if archive.is decided to also return garbage DNS results to Quad9 you would stop using them too? I get your sentiment, but allowing one single webpage on the internet to dictate who you are allowed to use for DNS is going too far in the other direction, IMHO

cnst 5y ago
It's a little ironic complaining about a single webpage on the internet, when you're suggesting that we use a single resolver on the internet instead of a distributed resolver system that we have otherwise. FWIIW, I use the resolver of my ISP, and 100% happy with the results. If your ISP provides incorrect and fake data to make extra money on advertising, maybe you should vote with your wallet and change the ISP.
- tomnipotent 5y ago
  ISP's regularly resell subscriber data, including DNS requests. They're also more likely to "play ball" with authorities. > we use a single resolver Cloudflare is still doing BGP like your ISP.
  - cnst 5y ago
    This is simply unsubstantiated — there's absolutely no reason to believe Cloudflare won't play ball with authorities. If anything, ISP DNS being a distributed system with independent ISPs all across the world, it would be much more difficult for the major agencies to control all the individual ISPs than it would be to simply control a single global entity with a US HQ and offices and POPs worldwide — Cloudflare.
    - tomnipotent 5y ago
      DNS is distributed, by design. Your ISP operates no differently than Cloudflare, and receives routing information from peers in the exact same way. There is nothing special or unique about consumer ISP-provided DNS. A DNS provider is either the definitive source and the buck stops there for a lookup, or it forwards to a peer for resolution. Cloudflare is not a telecom, which comes with regulation baggage that can be enforced. This matters a lot to a subpoena.
    - Brybry 5y ago
      They certainly make better privacy commitments and have more transparency than my ISP. Cloudflare DNS supports DNS-over-HTTPS and DNS-over-TLS. Cloudflare DNS claims to anonymize IPs in logs and only retain anonymized logs for 25 hours.[1] Cloudflare has warrant canaries[2] and publishes transparency reports[3]. Many (most?) of us do not have more than one to two choices for an ISP. Voting with our wallet is not possible and doesn't even make sense for DNS. I agree that centralizing under Cloudflare is unideal and I would gladly switch back to my ISP's DNS servers if they provided the same level of service and made similar commitments. [1] https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... [2] https://www.cloudflare.com/learning/privacy/what-is-warrant-canary/ https://www.cloudflare.com/learning/privacy/what-is-warrant-... [3] https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/
- smt88 5y ago
  Millions of people in the US can't change their ISP. I live in a major city and would have to drop my speed by 90% if I switched to my other option. I have two options total.
  - cnst 5y ago
    Doesn't T-Mobile US offer home internet over 4G and 5G in most of the US now? I've actually been using tethering for home internet, and it's often faster and cheaper than landline alternatives. Easily get 100Mbps in my location over 4G LTE on an old phone.
    - kayodelycaon 5y ago
      For the curious: https://www.t-mobile.com/coverage/coverage-map https://www.t-mobile.com/coverage/coverage-map
    - smt88 5y ago
      I don't think I could make do with less than 1 Gb/s (currently gave 1.3). I have a ton of home automation, a few HD cameras, and household members who stream video (or play games) basically 24/7.
      - cnst 5y ago
        Aren't you a big enough player to have your own recursive DNS, then? Plus, if you get so much bandwidth from your provider, are they really still messing about with your DNS?
    - eli 5y ago
      T-Mobile US is a funny example since they have been caught intercepting traffic for other DNS resolvers and silently responding with their own. https://esd.io/blog/t-mobile-dns-hijack.html https://esd.io/blog/t-mobile-dns-hijack.html
- toqy 5y ago
  > maybe you should vote with your wallet and change the ISP. Not a lot an option for many, most of my life I've lived in areas that only have a single choice.
- kjaftaedi 5y ago
  I'm not quite sure I get your point. I use the resolver of my ISP also, and they must recurse to cloudflare, because by default archive.is is broken for me at home. I am not going to change my ISP and not going to bow down to a single website that chooses to go against the good faith of distributed systems. I just don't visit their site anymore because that is the decision that they have made.

cnst 5y ago

It's a little ironic complaining about a single webpage on the internet, when you're suggesting that we use a single resolver on the internet instead of a distributed resolver system that we have otherwise. FWIIW, I use the resolver of my ISP, and 100% happy with the results. If your ISP provides incorrect and fake data to make extra money on advertising, maybe you should vote with your wallet and change the ISP.

tomnipotent 5y ago
ISP's regularly resell subscriber data, including DNS requests. They're also more likely to "play ball" with authorities. > we use a single resolver Cloudflare is still doing BGP like your ISP.
- cnst 5y ago
  This is simply unsubstantiated — there's absolutely no reason to believe Cloudflare won't play ball with authorities. If anything, ISP DNS being a distributed system with independent ISPs all across the world, it would be much more difficult for the major agencies to control all the individual ISPs than it would be to simply control a single global entity with a US HQ and offices and POPs worldwide — Cloudflare.
  - tomnipotent 5y ago
    DNS is distributed, by design. Your ISP operates no differently than Cloudflare, and receives routing information from peers in the exact same way. There is nothing special or unique about consumer ISP-provided DNS. A DNS provider is either the definitive source and the buck stops there for a lookup, or it forwards to a peer for resolution. Cloudflare is not a telecom, which comes with regulation baggage that can be enforced. This matters a lot to a subpoena.
  - Brybry 5y ago
    They certainly make better privacy commitments and have more transparency than my ISP. Cloudflare DNS supports DNS-over-HTTPS and DNS-over-TLS. Cloudflare DNS claims to anonymize IPs in logs and only retain anonymized logs for 25 hours.[1] Cloudflare has warrant canaries[2] and publishes transparency reports[3]. Many (most?) of us do not have more than one to two choices for an ISP. Voting with our wallet is not possible and doesn't even make sense for DNS. I agree that centralizing under Cloudflare is unideal and I would gladly switch back to my ISP's DNS servers if they provided the same level of service and made similar commitments. [1] https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... [2] https://www.cloudflare.com/learning/privacy/what-is-warrant-canary/ https://www.cloudflare.com/learning/privacy/what-is-warrant-... [3] https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/
smt88 5y ago
Millions of people in the US can't change their ISP. I live in a major city and would have to drop my speed by 90% if I switched to my other option. I have two options total.
- cnst 5y ago
  Doesn't T-Mobile US offer home internet over 4G and 5G in most of the US now? I've actually been using tethering for home internet, and it's often faster and cheaper than landline alternatives. Easily get 100Mbps in my location over 4G LTE on an old phone.
  - kayodelycaon 5y ago
    For the curious: https://www.t-mobile.com/coverage/coverage-map https://www.t-mobile.com/coverage/coverage-map
  - smt88 5y ago
    I don't think I could make do with less than 1 Gb/s (currently gave 1.3). I have a ton of home automation, a few HD cameras, and household members who stream video (or play games) basically 24/7.
    - cnst 5y ago
      Aren't you a big enough player to have your own recursive DNS, then? Plus, if you get so much bandwidth from your provider, are they really still messing about with your DNS?
  - eli 5y ago
    T-Mobile US is a funny example since they have been caught intercepting traffic for other DNS resolvers and silently responding with their own. https://esd.io/blog/t-mobile-dns-hijack.html https://esd.io/blog/t-mobile-dns-hijack.html
toqy 5y ago
> maybe you should vote with your wallet and change the ISP. Not a lot an option for many, most of my life I've lived in areas that only have a single choice.
kjaftaedi 5y ago
I'm not quite sure I get your point. I use the resolver of my ISP also, and they must recurse to cloudflare, because by default archive.is is broken for me at home. I am not going to change my ISP and not going to bow down to a single website that chooses to go against the good faith of distributed systems. I just don't visit their site anymore because that is the decision that they have made.